Change (Grids 17, 18, 19)
Change (Grids 17, 18, 19)
Change was a constant theme that emerged from the interviews. Few of the internal auditors had been in a stable environment for very long. Several of them had changed jobs in the recent past and in other casestherehadbeensignificantchangestotheorganisationinwhich they were working.
The principal changes that had impacted upon internal audit were changes to the group structure – most notably acquisitions and demergers - or to the organisation of internal audit itself. Nearly alloftheorganisationshadbeeninvolvedinsignificantacquisitions or demergers during the last three years. In the case of acquisitions
E MERGING I SSUES :E DUCATION ,C OMMUNICATION ,I NDEPENDENCE AND C HANGE 85
there was a need to integrate the acquired company into the group and,despiteduediligence,aneedtofindoutexactlywhathadbeen
acquired, the risks associated with the new company and its existing control processes.
We wouldn’t be involved in the due diligence up front, but what they’d do is, as soon as they bought it, they’d put in what they called a ‘SWAT’ team, which was an auditor, a legal person, a production guy, a quality, … a selection of people, just to go in and in a week, do a quick and dirty round the place, and report back to management. (A)
In the case of demergers, there was a need to set up an internal audit function from scratch or, in one case, to outsource internal audit.
So it was relatively new, it was a new board, I’d only just then been appointed as head of internal audit for the group, as opposed to the UK. The risk committee obviously was new, everything was fairly new at that stage. (H)
In one case a significant part of the organisation had been demergedwhichhadsimplifiedinternalauditoftheremainingpartof the organisation greatly and the internal audit function was adapting to that change.
Changes in organisational operations and structure, changes in board, audit committee and internal audit personnel and changes in corporate governance reporting requirements had all had an impact on the working environment of the interviewees. Where acquisitions orde-mergershadledtosignificantorganisationalchangewithinthe group, centralisation of internal audit often followed, with a new head of internal audit (or an equivalent function such as “process review”). In groups of companies, practice sometimes varied across the group,
86 T HE T URNBULL R EPORT ,I NTERNAL C ONTROL AND R ISK M ANAGEMENT :
with some in-house and some outsourced internal audit and this needed to be standardised.
There had been different approaches to internal audit, so the Finance Director of the UK had taken the decision that he wanted an in- house function, others were going for peer review type internal audit work, more informal really. Some were actually outsourcing to our external auditors … to come in and conduct internal audit review work. So there had been a bit of a mish-mash of different ways of addressing internal audit and it was very much left to each division as to the way they wanted to do it. (H)
In several companies, the introduction of Turnbull reporting coincided conveniently with such an internal change process, allowing the necessary systems to be put in place alongside the commencement of a new operating procedure.
I guess there were a number of changes. One was in terms of reporting, in terms of changing the grading of the reports, the structure of the reports, prioritising recommendations. Secondly, in terms of the way that people did jobs, placing a lot greater importance on planning. People certainly, when they went overseas, used to do something which I call parachuting in, which is basically, I guess, go with their auditor’s toolkit, parachute into a country and then decide what they wanted to do while they were on the ground. So I put a lot more priority in terms of planning and risk rating of individual areas of the businesses, so that we know we focus on the key risks within individual businesses, the important areas within individual businesses, and because one of the things that happened in the past was that they basically had a standard programme which they went in and what you found over a period of time is that certain people had certain interests in certain areas of the business and that’s where we focused on. (J)
E MERGING I SSUES :E DUCATION ,C OMMUNICATION ,I NDEPENDENCE AND C HANGE 87
Significantchangesweretakingplaceintheworkofinternalaudit. In some cases, the internal audit function had taken an explicit role in the change management process:
... last March we acquired one of our key competitors in the UK … it has been quite an exciting time and to me that’s exactly where this function fits in because we should be, if you like, leading and facilitating and supporting management through change. Because the bottom line is that that’s always the riskiest thing that you are faced with, so change and integration and so on. We had two distinct processes, two distinct teams, two distinct cultures, that type of thing that had to be brought together and integrated. So we have played,
I think, clearly a supportive role to the management team, we have dropped into a lot of facilitation work with them … You know, we have challenged them on a lot of their change initiatives, looked at their process around, if you like, driving change, effectiveness of communication we have observed. (S)
The role of compliance testing was often viewed as far less important:
I think there is still a reliance on internal audit to … do quite traditional stock checking and float checking and stuff like that, and that is stuff where we don’t add value and I don’t want us to be really focusing on that. (H)
The traditional approach of tick and bash is that you do a lot of work to prove that control is in place, but probably don’t come up with wonderfully commercial, productive output in your internal audit. You get this wonderful warm sense that you’ve got great controls in place, but they cost you the earth to get there and therefore are actually not worth doing. (I)
Responsibility for a lot of the work that people perceive as being internal audit work, in other words compliance, would be positioned
88 T HE T URNBULL R EPORT ,I NTERNAL C ONTROL AND R ISK M ANAGEMENT :
totally with line management and they would choose from a range of techniques to monitor compliance. Not necessarily using “auditors” or “policemen”. They could use self-assessment, peer reviews, information systems, whatever is most effective. (Q)
Although there was an alternative view:
I believe any internal audit function, no matter what else it may progress to, should never lose sight of the fact that from a management point of view, that is a very valuable assurance that you can give. They do want to know that the basic control structure is in place, and appropriate, and functioning. (B)
Interviewees also reported the need to reframe perceptions of internal audit within their organisations, accompanying the operational changes:
When I first came in people said “Why do you need to look at this and why do you need to look at that”, and now we actually get people contacting us and saying “Could you put somebody onto this project, and could I get somebody to just cast their eye over this and, you know, give us internal audits perspective on it?”, so I am actually at the point now when I have to say, no we can’t. People always think that they know what internal audit is about, and generally it is nothing like what it is about, so I’m trying to dispel some of the myths … [like] thinking that you are there to catch them out and trip them up. (H)
But I think sometimes we’re seen as the brake, if you like. I think they see us as an obstacle to get over at times. (P)
Several of the interviewees distinguished “reviews” from audit. Reviews appeared to be focused on particular aspects of the business or operating units and were frequently ad hoc rather than pre-planned parts of the work programme. They seemed to be less evidence-based
E MERGING I SSUES :E DUCATION ,C OMMUNICATION ,I NDEPENDENCE AND C HANGE 89
in the same way in different organisations. Changes to internal audit departments were also associated with changes to personnel, either in the internal audit department itself or, for example, changes of chief executiveofficerorfinancialdirector.